search

Urigo / tortilla

The Framework for tutorials
MIT License
51 stars 5 forks source link

fix(deps): update dependency handlebars to v4.7.7 [security] - abandoned #238

Open renovate[bot] opened 3 years ago

renovate[bot] commented 3 years ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
handlebars (source) 4.7.2 -> 4.7.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-23369

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

CVE-2021-23383

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Release Notes

wycats/handlebars.js ### [`v4.7.7`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v477---February-15th-2021) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.6...v4.7.7) - fix weird error in integration tests - [`eb860c0`](https://togithub.com/wycats/handlebars.js/commit/eb860c0) - fix: check prototype property access in strict-mode ([#​1736](https://togithub.com/wycats/handlebars.js/issues/1736)) - [`b6d3de7`](https://togithub.com/wycats/handlebars.js/commit/b6d3de7) - fix: escape property names in compat mode ([#​1736](https://togithub.com/wycats/handlebars.js/issues/1736)) - [`f058970`](https://togithub.com/wycats/handlebars.js/commit/f058970) - refactor: In spec tests, use expectTemplate over equals and shouldThrow ([#​1683](https://togithub.com/wycats/handlebars.js/issues/1683)) - [`77825f8`](https://togithub.com/wycats/handlebars.js/commit/77825f8) - chore: start testing on Node.js 12 and 13 - [`3789a30`](https://togithub.com/wycats/handlebars.js/commit/3789a30) (POSSIBLY) BREAKING CHANGES: - the changes from version [4.6.0](https://togithub.com/handlebars-lang/handlebars.js/blob/master/release-notes.md#v460---january-8th-2020) now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See [#​1633](https://togithub.com/wycats/handlebars.js/issues/1633) for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build. That is why we only bump the patch version despite mentioning breaking changes. [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.6...v4.7.7) ### [`v4.7.6`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v476---April-3rd-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.5...v4.7.6) Chore/Housekeeping: - [#​1672](https://togithub.com/handlebars-lang/handlebars.js/issues/1672) - Switch cmd parser to latest minimist ([@​dougwilson](https://api.github.com/users/dougwilson) Compatibility notes: - Restored Node.js compatibility [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.5...v4.7.6) ### [`v4.7.5`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v475---April-2nd-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.4...v4.7.5) Chore/Housekeeping: - \~Node.js version support has been changed to v6+~ Reverted in 4.7.6 Compatibility notes: - \~Node.js < v6 is no longer supported~ Reverted in 4.7.6 [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.4...v4.7.5) ### [`v4.7.4`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v474---April-1st-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.3...v4.7.4) Chore/Housekeeping: - [#​1666](https://togithub.com/handlebars-lang/handlebars.js/issues/1666) - Replaced minimist with yargs for handlebars CLI ([@​aorinevo](https://api.github.com/users/aorinevo), [@​AviVahl](https://api.github.com/users/AviVahl) & [@​fabb](https://api.github.com/users/fabb)) Compatibility notes: - No incompatibilities are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.3...v4.7.4) ### [`v4.7.3`](https://togithub.com/wycats/handlebars.js/blob/HEAD/release-notes.md#v473---February-5th-2020) [Compare Source](https://togithub.com/wycats/handlebars.js/compare/v4.7.2...v4.7.3) Chore/Housekeeping: - [#​1644](https://togithub.com/handlebars-lang/handlebars.js/issues/1644) - Download links to aws broken on handlebarsjs.com - access denied ([@​Tea56](https://api.github.com/users/Tea56)) - Fix spelling and punctuation in changelog - [`d78cc73`](https://togithub.com/wycats/handlebars.js/commit/d78cc73) Bugfixes: - Add Type Definition for Handlebars.VERSION, Fixes [#​1647](https://togithub.com/wycats/handlebars.js/issues/1647) - [`4de51fe`](https://togithub.com/wycats/handlebars.js/commit/4de51fe) - Include Type Definition for runtime.js in Package - [`a32d05f`](https://togithub.com/wycats/handlebars.js/commit/a32d05f) Compatibility notes: - No incompatibilities are to be expected [Commits](https://togithub.com/handlebars-lang/handlebars.js/compare/v4.7.2...v4.7.3)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 1 year ago

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

renovate[bot] commented 1 year ago

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.